Analyzing and investigating sign-in logs to troubleshoot access issues
In Chapter 9, Planning, Implementing, and Administering Conditional Access and Azure Identity Protection, we discussed how user and sign-in risk can be used as a condition for access and authorization to applications. Azure Identity Protection utilizes the activity logs to determine potential threats, vulnerabilities, and anomalous behavior among users. Sign-in logs are based on two types of reporting: activity and security.
Activity reporting within Microsoft shows what is taking place within the infrastructure. The various activities include the following:
- Sign-ins, which is the usage information of managed applications and user sign-in activities within Azure AD or a hybrid identity architecture.
- Audit logs that provide system activity for users and groups, managed applications, and directory activities.
- Provisioning logs enable customers to monitor activity that pertains to the provisioning...
